{
  "type": "URL",
  "indicator": "https://forms.static.microsoft/scripts/dists/dll-react.min.aadf17e.js",
  "general": {
    "sections": [
      "general",
      "url_list",
      "http_scans",
      "screenshot"
    ],
    "indicator": "https://forms.static.microsoft/scripts/dists/dll-react.min.aadf17e.js",
    "type": "url",
    "type_title": "URL",
    "validation": [],
    "base_indicator": {
      "id": 4205309908,
      "indicator": "https://forms.static.microsoft/scripts/dists/dll-react.min.aadf17e.js",
      "type": "URL",
      "title": "",
      "description": "",
      "content": "",
      "access_type": "public",
      "access_reason": ""
    },
    "pulse_info": {
      "count": 5,
      "pulses": [
        {
          "id": "6a04e84167efe8b5fa43e0ca",
          "name": "cve-2020-0601 + spoof signing",
          "description": "CVE2020-0601 is a Curveball vulnerability that could allow attackers to spoof signatures and is a high cryptographic validation flaw. Per NIST, \"A spoofing vulnerability exists in the way Windows CryptoAPI (Crypt32.dll) validates Elliptic Curve Cryptography (ECC) certificates. An attacker could exploit the vulnerability by using a spoofed code-signing certificate to sign a malicious executable, making it appear the file was from a trusted, legitimate source, aka 'Windows CryptoAPI Spoofing Vulnerability',\".",
          "modified": "2026-05-14T01:04:28.762000",
          "created": "2026-05-13T21:08:17.669000",
          "tags": [
            "indicators show",
            "search",
            "type indicator",
            "role title",
            "added active",
            "related pulses",
            "instagram",
            "identifier",
            "cve-2020-0601"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 0,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "msudosos",
            "id": "381696",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "CVE": 51,
            "hostname": 147,
            "FileHash-SHA1": 4,
            "domain": 119,
            "URL": 169,
            "IPv4": 282,
            "FileHash-MD5": 3,
            "FileHash-SHA256": 283
          },
          "indicator_count": 1058,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 67,
          "modified_text": "18 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "6a04e8423bba51f1e0ff3030",
          "name": "cve-2020-0601 + spoof signing",
          "description": "CVE2020-0601 is a Curveball vulnerability that could allow attackers to spoof signatures and is a high cryptographic validation flaw. Per NIST, \"A spoofing vulnerability exists in the way Windows CryptoAPI (Crypt32.dll) validates Elliptic Curve Cryptography (ECC) certificates. An attacker could exploit the vulnerability by using a spoofed code-signing certificate to sign a malicious executable, making it appear the file was from a trusted, legitimate source, aka 'Windows CryptoAPI Spoofing Vulnerability',\".",
          "modified": "2026-05-13T22:50:49.596000",
          "created": "2026-05-13T21:08:18.159000",
          "tags": [
            "indicators show",
            "search",
            "type indicator",
            "role title",
            "added active",
            "related pulses",
            "instagram",
            "identifier",
            "cve-2020-0601"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 0,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "msudosos",
            "id": "381696",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "CVE": 51,
            "hostname": 147,
            "FileHash-SHA1": 4,
            "domain": 119,
            "URL": 169,
            "IPv4": 281,
            "FileHash-MD5": 3,
            "FileHash-SHA256": 283
          },
          "indicator_count": 1057,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 67,
          "modified_text": "18 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "6a04e83b9a762101e54d6a4f",
          "name": "cve-2020-0601 + spoof signing",
          "description": "CVE2020-0601 is a Curveball vulnerability that could allow attackers to spoof signatures and is a high cryptographic validation flaw. Per NIST, \"A spoofing vulnerability exists in the way Windows CryptoAPI (Crypt32.dll) validates Elliptic Curve Cryptography (ECC) certificates. An attacker could exploit the vulnerability by using a spoofed code-signing certificate to sign a malicious executable, making it appear the file was from a trusted, legitimate source, aka 'Windows CryptoAPI Spoofing Vulnerability',\".",
          "modified": "2026-05-13T22:50:48.345000",
          "created": "2026-05-13T21:08:11.231000",
          "tags": [
            "indicators show",
            "search",
            "type indicator",
            "role title",
            "added active",
            "related pulses",
            "instagram",
            "identifier",
            "cve-2020-0601"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 0,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 1,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "msudosos",
            "id": "381696",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "CVE": 53,
            "hostname": 147,
            "FileHash-SHA1": 24,
            "domain": 119,
            "URL": 167,
            "IPv4": 281,
            "FileHash-MD5": 15,
            "FileHash-SHA256": 469,
            "Mutex": 2
          },
          "indicator_count": 1277,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 67,
          "modified_text": "18 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "69ce1c7b60a3065cc75b7e23",
          "name": "Chance Encounter Clone CREDIT: UCP_GoA23 Public - same watering hole?",
          "description": "",
          "modified": "2026-04-21T05:29:42.247000",
          "created": "2026-04-02T07:36:27.829000",
          "tags": [
            "raspberry pi",
            "hdmi",
            "hdmi mode",
            "uncomment",
            "additional",
            "usb mass",
            "pi02",
            "pi zero",
            "zero",
            "enable drm",
            "program",
            "license",
            "free software",
            "foundation",
            "general public",
            "gnu general",
            "public license",
            "the program",
            "copyright",
            "sections",
            "june",
            "general",
            "april",
            "vice",
            "drivers",
            "analog",
            "digital",
            "video",
            "bus support",
            "media",
            "accelerometers",
            "capacitance",
            "resolver",
            "android",
            "flash",
            "monitoring",
            "codec",
            "loop",
            "light",
            "linear",
            "tools",
            "class",
            "speakup",
            "core support",
            "legacy",
            "kernel",
            "this software",
            "including",
            "but not",
            "limited to",
            "ltd all",
            "redistributions",
            "disclaimer",
            "is provided",
            "damage",
            "info",
            "params",
            "gpio",
            "gpio pin",
            "select",
            "digital volume",
            "load",
            "gpios",
            "compute module",
            "spi bus",
            "front",
            "clock",
            "speed",
            "tiny",
            "kali",
            "oled",
            "systemd",
            "digi",
            "miso",
            "screen",
            "show",
            "global property",
            "bootmenu",
            "label",
            "booting",
            "please",
            "javascript",
            "entity",
            "file list",
            "size first",
            "credits text",
            "readme text",
            "no meaningful",
            "url list",
            "status https",
            "domain list",
            "enom",
            "registrar",
            "ltd dba",
            "com laude",
            "ip address",
            "ip adresses",
            "U of A",
            "GoA",
            "Treaty 6",
            "Treaty 7",
            "Treaty 8",
            "AHS"
          ],
          "references": [
            "cmdline.txt",
            "config.txt",
            "COPYING.linux",
            "config-5.15.44-Re4son-v7+",
            "config-5.15.44-Re4son-v7l+",
            "config-5.15.44-Re4son-v8l+",
            "config-5.15.44-Re4son+",
            "config-5.15.44-Re4son-v8+",
            "grub_background.sh",
            "LICENCE.broadcom",
            "README",
            "theme.txt",
            "https://www.virustotal.com/gui/file/4b2f7e790d88a330808e6b2a81c8ea81268f69eb6c10ad4beccf2063158d0423/details",
            "https://www.virustotal.com/gui/file/4b2f7e790d88a330808e6b2a81c8ea81268f69eb6c10ad4beccf2063158d0423/relations",
            "https://www.virustotal.com/gui/file/4b2f7e790d88a330808e6b2a81c8ea81268f69eb6c10ad4beccf2063158d0423/behavior",
            "https://www.virustotal.com/gui/collection/cd709a94571c706f4c86a2432508b5fa9e3618a4ba42f5773306208a431ae01e",
            "https://www.virustotal.com/graph/embed/g24019548c37d405da58015e7220072ab73c17ac93ac14e538e1f4535dda6c615?theme=dark",
            "https://www.virustotal.com/gui/collection/cd709a94571c706f4c86a2432508b5fa9e3618a4ba42f5773306208a431ae01e/iocs"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "Canada"
          ],
          "malware_families": [],
          "attack_ids": [
            {
              "id": "T1010",
              "name": "Application Window Discovery",
              "display_name": "T1010 - Application Window Discovery"
            },
            {
              "id": "T1011",
              "name": "Exfiltration Over Other Network Medium",
              "display_name": "T1011 - Exfiltration Over Other Network Medium"
            },
            {
              "id": "T1050",
              "name": "New Service",
              "display_name": "T1050 - New Service"
            },
            {
              "id": "T1070",
              "name": "Indicator Removal on Host",
              "display_name": "T1070 - Indicator Removal on Host"
            },
            {
              "id": "T1080",
              "name": "Taint Shared Content",
              "display_name": "T1080 - Taint Shared Content"
            },
            {
              "id": "T1211",
              "name": "Exploitation for Defense Evasion",
              "display_name": "T1211 - Exploitation for Defense Evasion"
            },
            {
              "id": "T1059",
              "name": "Command and Scripting Interpreter",
              "display_name": "T1059 - Command and Scripting Interpreter"
            }
          ],
          "industries": [
            "Education",
            "Government",
            "Healthcare",
            "Telecommunications",
            "Agriculture",
            "Finance",
            "Transportation"
          ],
          "TLP": "white",
          "cloned_from": "698f07428f6e35876e034e41",
          "export_count": 0,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "msudosos",
            "id": "381696",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "domain": 812,
            "URL": 2492,
            "hostname": 1171,
            "FileHash-SHA256": 2057,
            "CVE": 2,
            "FileHash-MD5": 14,
            "FileHash-SHA1": 16,
            "email": 2,
            "CIDR": 118
          },
          "indicator_count": 6684,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 66,
          "modified_text": "41 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "698f07428f6e35876e034e41",
          "name": "Chance Encounter Commuting from U of A to GoA - 02.13.2026",
          "description": "My 1st Graph: Hidden Boots on my Phone ( Chance Encounter Commuting from U of A to GoA - 02.13.2026 ). \nConclusion: U of A and the Governments of Alberta, and those of Treaty 6/7/8 have been victims of crime.\nhttps://www.virustotal.com/graph/embed/g24019548c37d405da58015e7220072ab73c17ac93ac14e538e1f4535dda6c615?theme=dark",
          "modified": "2026-03-15T10:19:15.579000",
          "created": "2026-02-13T11:13:03.870000",
          "tags": [
            "raspberry pi",
            "hdmi",
            "hdmi mode",
            "uncomment",
            "additional",
            "usb mass",
            "pi02",
            "pi zero",
            "zero",
            "enable drm",
            "program",
            "license",
            "free software",
            "foundation",
            "general public",
            "gnu general",
            "public license",
            "the program",
            "copyright",
            "sections",
            "june",
            "general",
            "april",
            "vice",
            "drivers",
            "analog",
            "digital",
            "video",
            "bus support",
            "media",
            "accelerometers",
            "capacitance",
            "resolver",
            "android",
            "flash",
            "monitoring",
            "codec",
            "loop",
            "light",
            "linear",
            "tools",
            "class",
            "speakup",
            "core support",
            "legacy",
            "kernel",
            "this software",
            "including",
            "but not",
            "limited to",
            "ltd all",
            "redistributions",
            "disclaimer",
            "is provided",
            "damage",
            "info",
            "params",
            "gpio",
            "gpio pin",
            "select",
            "digital volume",
            "load",
            "gpios",
            "compute module",
            "spi bus",
            "front",
            "clock",
            "speed",
            "tiny",
            "kali",
            "oled",
            "systemd",
            "digi",
            "miso",
            "screen",
            "show",
            "global property",
            "bootmenu",
            "label",
            "booting",
            "please",
            "javascript",
            "entity",
            "file list",
            "size first",
            "credits text",
            "readme text",
            "no meaningful",
            "url list",
            "status https",
            "domain list",
            "enom",
            "registrar",
            "ltd dba",
            "com laude",
            "ip address",
            "ip adresses",
            "U of A",
            "GoA",
            "Treaty 6",
            "Treaty 7",
            "Treaty 8",
            "AHS"
          ],
          "references": [
            "cmdline.txt",
            "config.txt",
            "COPYING.linux",
            "config-5.15.44-Re4son-v7+",
            "config-5.15.44-Re4son-v7l+",
            "config-5.15.44-Re4son-v8l+",
            "config-5.15.44-Re4son+",
            "config-5.15.44-Re4son-v8+",
            "grub_background.sh",
            "LICENCE.broadcom",
            "README",
            "theme.txt",
            "https://www.virustotal.com/gui/file/4b2f7e790d88a330808e6b2a81c8ea81268f69eb6c10ad4beccf2063158d0423/details",
            "https://www.virustotal.com/gui/file/4b2f7e790d88a330808e6b2a81c8ea81268f69eb6c10ad4beccf2063158d0423/relations",
            "https://www.virustotal.com/gui/file/4b2f7e790d88a330808e6b2a81c8ea81268f69eb6c10ad4beccf2063158d0423/behavior",
            "https://www.virustotal.com/gui/collection/cd709a94571c706f4c86a2432508b5fa9e3618a4ba42f5773306208a431ae01e",
            "https://www.virustotal.com/graph/embed/g24019548c37d405da58015e7220072ab73c17ac93ac14e538e1f4535dda6c615?theme=dark",
            "https://www.virustotal.com/gui/collection/cd709a94571c706f4c86a2432508b5fa9e3618a4ba42f5773306208a431ae01e/iocs"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "Canada"
          ],
          "malware_families": [],
          "attack_ids": [
            {
              "id": "T1010",
              "name": "Application Window Discovery",
              "display_name": "T1010 - Application Window Discovery"
            },
            {
              "id": "T1011",
              "name": "Exfiltration Over Other Network Medium",
              "display_name": "T1011 - Exfiltration Over Other Network Medium"
            },
            {
              "id": "T1050",
              "name": "New Service",
              "display_name": "T1050 - New Service"
            },
            {
              "id": "T1070",
              "name": "Indicator Removal on Host",
              "display_name": "T1070 - Indicator Removal on Host"
            },
            {
              "id": "T1080",
              "name": "Taint Shared Content",
              "display_name": "T1080 - Taint Shared Content"
            },
            {
              "id": "T1211",
              "name": "Exploitation for Defense Evasion",
              "display_name": "T1211 - Exploitation for Defense Evasion"
            },
            {
              "id": "T1059",
              "name": "Command and Scripting Interpreter",
              "display_name": "T1059 - Command and Scripting Interpreter"
            }
          ],
          "industries": [
            "Education",
            "Government",
            "Healthcare",
            "Telecommunications",
            "Agriculture",
            "Finance",
            "Transportation"
          ],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 0,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "UCP_GoA23",
            "id": "382539",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_382539/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "domain": 812,
            "URL": 2492,
            "hostname": 1171,
            "FileHash-SHA256": 2057,
            "CVE": 2,
            "FileHash-MD5": 14,
            "FileHash-SHA1": 16,
            "email": 2,
            "CIDR": 118
          },
          "indicator_count": 6684,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 20,
          "modified_text": "78 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        }
      ],
      "references": [
        "https://www.virustotal.com/gui/file/4b2f7e790d88a330808e6b2a81c8ea81268f69eb6c10ad4beccf2063158d0423/details",
        "config-5.15.44-Re4son-v8l+",
        "config-5.15.44-Re4son-v7l+",
        "config-5.15.44-Re4son-v8+",
        "https://www.virustotal.com/gui/file/4b2f7e790d88a330808e6b2a81c8ea81268f69eb6c10ad4beccf2063158d0423/relations",
        "config-5.15.44-Re4son-v7+",
        "grub_background.sh",
        "README",
        "cmdline.txt",
        "https://www.virustotal.com/graph/embed/g24019548c37d405da58015e7220072ab73c17ac93ac14e538e1f4535dda6c615?theme=dark",
        "https://www.virustotal.com/gui/file/4b2f7e790d88a330808e6b2a81c8ea81268f69eb6c10ad4beccf2063158d0423/behavior",
        "https://www.virustotal.com/gui/collection/cd709a94571c706f4c86a2432508b5fa9e3618a4ba42f5773306208a431ae01e",
        "config-5.15.44-Re4son+",
        "config.txt",
        "https://www.virustotal.com/gui/collection/cd709a94571c706f4c86a2432508b5fa9e3618a4ba42f5773306208a431ae01e/iocs",
        "COPYING.linux",
        "theme.txt",
        "LICENCE.broadcom"
      ],
      "related": {
        "alienvault": {
          "adversary": [],
          "malware_families": [],
          "industries": [],
          "unique_indicators": 0
        },
        "other": {
          "adversary": [],
          "malware_families": [],
          "industries": [
            "Education",
            "Healthcare",
            "Agriculture",
            "Telecommunications",
            "Government",
            "Transportation",
            "Finance"
          ],
          "unique_indicators": 8318
        }
      }
    },
    "false_positive": [],
    "alexa": "http://www.alexa.com/siteinfo/static.microsoft",
    "whois": "http://whois.domaintools.com/static.microsoft",
    "domain": "static.microsoft",
    "hostname": "forms.static.microsoft"
  },
  "geo": {},
  "geo_ipapicom": {},
  "pulse_count": 5,
  "pulses": [
    {
      "id": "6a04e84167efe8b5fa43e0ca",
      "name": "cve-2020-0601 + spoof signing",
      "description": "CVE2020-0601 is a Curveball vulnerability that could allow attackers to spoof signatures and is a high cryptographic validation flaw. Per NIST, \"A spoofing vulnerability exists in the way Windows CryptoAPI (Crypt32.dll) validates Elliptic Curve Cryptography (ECC) certificates. An attacker could exploit the vulnerability by using a spoofed code-signing certificate to sign a malicious executable, making it appear the file was from a trusted, legitimate source, aka 'Windows CryptoAPI Spoofing Vulnerability',\".",
      "modified": "2026-05-14T01:04:28.762000",
      "created": "2026-05-13T21:08:17.669000",
      "tags": [
        "indicators show",
        "search",
        "type indicator",
        "role title",
        "added active",
        "related pulses",
        "instagram",
        "identifier",
        "cve-2020-0601"
      ],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 0,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "msudosos",
        "id": "381696",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "CVE": 51,
        "hostname": 147,
        "FileHash-SHA1": 4,
        "domain": 119,
        "URL": 169,
        "IPv4": 282,
        "FileHash-MD5": 3,
        "FileHash-SHA256": 283
      },
      "indicator_count": 1058,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 67,
      "modified_text": "18 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "6a04e8423bba51f1e0ff3030",
      "name": "cve-2020-0601 + spoof signing",
      "description": "CVE2020-0601 is a Curveball vulnerability that could allow attackers to spoof signatures and is a high cryptographic validation flaw. Per NIST, \"A spoofing vulnerability exists in the way Windows CryptoAPI (Crypt32.dll) validates Elliptic Curve Cryptography (ECC) certificates. An attacker could exploit the vulnerability by using a spoofed code-signing certificate to sign a malicious executable, making it appear the file was from a trusted, legitimate source, aka 'Windows CryptoAPI Spoofing Vulnerability',\".",
      "modified": "2026-05-13T22:50:49.596000",
      "created": "2026-05-13T21:08:18.159000",
      "tags": [
        "indicators show",
        "search",
        "type indicator",
        "role title",
        "added active",
        "related pulses",
        "instagram",
        "identifier",
        "cve-2020-0601"
      ],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 0,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "msudosos",
        "id": "381696",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "CVE": 51,
        "hostname": 147,
        "FileHash-SHA1": 4,
        "domain": 119,
        "URL": 169,
        "IPv4": 281,
        "FileHash-MD5": 3,
        "FileHash-SHA256": 283
      },
      "indicator_count": 1057,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 67,
      "modified_text": "18 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "6a04e83b9a762101e54d6a4f",
      "name": "cve-2020-0601 + spoof signing",
      "description": "CVE2020-0601 is a Curveball vulnerability that could allow attackers to spoof signatures and is a high cryptographic validation flaw. Per NIST, \"A spoofing vulnerability exists in the way Windows CryptoAPI (Crypt32.dll) validates Elliptic Curve Cryptography (ECC) certificates. An attacker could exploit the vulnerability by using a spoofed code-signing certificate to sign a malicious executable, making it appear the file was from a trusted, legitimate source, aka 'Windows CryptoAPI Spoofing Vulnerability',\".",
      "modified": "2026-05-13T22:50:48.345000",
      "created": "2026-05-13T21:08:11.231000",
      "tags": [
        "indicators show",
        "search",
        "type indicator",
        "role title",
        "added active",
        "related pulses",
        "instagram",
        "identifier",
        "cve-2020-0601"
      ],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 0,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 1,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "msudosos",
        "id": "381696",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "CVE": 53,
        "hostname": 147,
        "FileHash-SHA1": 24,
        "domain": 119,
        "URL": 167,
        "IPv4": 281,
        "FileHash-MD5": 15,
        "FileHash-SHA256": 469,
        "Mutex": 2
      },
      "indicator_count": 1277,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 67,
      "modified_text": "18 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "69ce1c7b60a3065cc75b7e23",
      "name": "Chance Encounter Clone CREDIT: UCP_GoA23 Public - same watering hole?",
      "description": "",
      "modified": "2026-04-21T05:29:42.247000",
      "created": "2026-04-02T07:36:27.829000",
      "tags": [
        "raspberry pi",
        "hdmi",
        "hdmi mode",
        "uncomment",
        "additional",
        "usb mass",
        "pi02",
        "pi zero",
        "zero",
        "enable drm",
        "program",
        "license",
        "free software",
        "foundation",
        "general public",
        "gnu general",
        "public license",
        "the program",
        "copyright",
        "sections",
        "june",
        "general",
        "april",
        "vice",
        "drivers",
        "analog",
        "digital",
        "video",
        "bus support",
        "media",
        "accelerometers",
        "capacitance",
        "resolver",
        "android",
        "flash",
        "monitoring",
        "codec",
        "loop",
        "light",
        "linear",
        "tools",
        "class",
        "speakup",
        "core support",
        "legacy",
        "kernel",
        "this software",
        "including",
        "but not",
        "limited to",
        "ltd all",
        "redistributions",
        "disclaimer",
        "is provided",
        "damage",
        "info",
        "params",
        "gpio",
        "gpio pin",
        "select",
        "digital volume",
        "load",
        "gpios",
        "compute module",
        "spi bus",
        "front",
        "clock",
        "speed",
        "tiny",
        "kali",
        "oled",
        "systemd",
        "digi",
        "miso",
        "screen",
        "show",
        "global property",
        "bootmenu",
        "label",
        "booting",
        "please",
        "javascript",
        "entity",
        "file list",
        "size first",
        "credits text",
        "readme text",
        "no meaningful",
        "url list",
        "status https",
        "domain list",
        "enom",
        "registrar",
        "ltd dba",
        "com laude",
        "ip address",
        "ip adresses",
        "U of A",
        "GoA",
        "Treaty 6",
        "Treaty 7",
        "Treaty 8",
        "AHS"
      ],
      "references": [
        "cmdline.txt",
        "config.txt",
        "COPYING.linux",
        "config-5.15.44-Re4son-v7+",
        "config-5.15.44-Re4son-v7l+",
        "config-5.15.44-Re4son-v8l+",
        "config-5.15.44-Re4son+",
        "config-5.15.44-Re4son-v8+",
        "grub_background.sh",
        "LICENCE.broadcom",
        "README",
        "theme.txt",
        "https://www.virustotal.com/gui/file/4b2f7e790d88a330808e6b2a81c8ea81268f69eb6c10ad4beccf2063158d0423/details",
        "https://www.virustotal.com/gui/file/4b2f7e790d88a330808e6b2a81c8ea81268f69eb6c10ad4beccf2063158d0423/relations",
        "https://www.virustotal.com/gui/file/4b2f7e790d88a330808e6b2a81c8ea81268f69eb6c10ad4beccf2063158d0423/behavior",
        "https://www.virustotal.com/gui/collection/cd709a94571c706f4c86a2432508b5fa9e3618a4ba42f5773306208a431ae01e",
        "https://www.virustotal.com/graph/embed/g24019548c37d405da58015e7220072ab73c17ac93ac14e538e1f4535dda6c615?theme=dark",
        "https://www.virustotal.com/gui/collection/cd709a94571c706f4c86a2432508b5fa9e3618a4ba42f5773306208a431ae01e/iocs"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "Canada"
      ],
      "malware_families": [],
      "attack_ids": [
        {
          "id": "T1010",
          "name": "Application Window Discovery",
          "display_name": "T1010 - Application Window Discovery"
        },
        {
          "id": "T1011",
          "name": "Exfiltration Over Other Network Medium",
          "display_name": "T1011 - Exfiltration Over Other Network Medium"
        },
        {
          "id": "T1050",
          "name": "New Service",
          "display_name": "T1050 - New Service"
        },
        {
          "id": "T1070",
          "name": "Indicator Removal on Host",
          "display_name": "T1070 - Indicator Removal on Host"
        },
        {
          "id": "T1080",
          "name": "Taint Shared Content",
          "display_name": "T1080 - Taint Shared Content"
        },
        {
          "id": "T1211",
          "name": "Exploitation for Defense Evasion",
          "display_name": "T1211 - Exploitation for Defense Evasion"
        },
        {
          "id": "T1059",
          "name": "Command and Scripting Interpreter",
          "display_name": "T1059 - Command and Scripting Interpreter"
        }
      ],
      "industries": [
        "Education",
        "Government",
        "Healthcare",
        "Telecommunications",
        "Agriculture",
        "Finance",
        "Transportation"
      ],
      "TLP": "white",
      "cloned_from": "698f07428f6e35876e034e41",
      "export_count": 0,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "msudosos",
        "id": "381696",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "domain": 812,
        "URL": 2492,
        "hostname": 1171,
        "FileHash-SHA256": 2057,
        "CVE": 2,
        "FileHash-MD5": 14,
        "FileHash-SHA1": 16,
        "email": 2,
        "CIDR": 118
      },
      "indicator_count": 6684,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 66,
      "modified_text": "41 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "698f07428f6e35876e034e41",
      "name": "Chance Encounter Commuting from U of A to GoA - 02.13.2026",
      "description": "My 1st Graph: Hidden Boots on my Phone ( Chance Encounter Commuting from U of A to GoA - 02.13.2026 ). \nConclusion: U of A and the Governments of Alberta, and those of Treaty 6/7/8 have been victims of crime.\nhttps://www.virustotal.com/graph/embed/g24019548c37d405da58015e7220072ab73c17ac93ac14e538e1f4535dda6c615?theme=dark",
      "modified": "2026-03-15T10:19:15.579000",
      "created": "2026-02-13T11:13:03.870000",
      "tags": [
        "raspberry pi",
        "hdmi",
        "hdmi mode",
        "uncomment",
        "additional",
        "usb mass",
        "pi02",
        "pi zero",
        "zero",
        "enable drm",
        "program",
        "license",
        "free software",
        "foundation",
        "general public",
        "gnu general",
        "public license",
        "the program",
        "copyright",
        "sections",
        "june",
        "general",
        "april",
        "vice",
        "drivers",
        "analog",
        "digital",
        "video",
        "bus support",
        "media",
        "accelerometers",
        "capacitance",
        "resolver",
        "android",
        "flash",
        "monitoring",
        "codec",
        "loop",
        "light",
        "linear",
        "tools",
        "class",
        "speakup",
        "core support",
        "legacy",
        "kernel",
        "this software",
        "including",
        "but not",
        "limited to",
        "ltd all",
        "redistributions",
        "disclaimer",
        "is provided",
        "damage",
        "info",
        "params",
        "gpio",
        "gpio pin",
        "select",
        "digital volume",
        "load",
        "gpios",
        "compute module",
        "spi bus",
        "front",
        "clock",
        "speed",
        "tiny",
        "kali",
        "oled",
        "systemd",
        "digi",
        "miso",
        "screen",
        "show",
        "global property",
        "bootmenu",
        "label",
        "booting",
        "please",
        "javascript",
        "entity",
        "file list",
        "size first",
        "credits text",
        "readme text",
        "no meaningful",
        "url list",
        "status https",
        "domain list",
        "enom",
        "registrar",
        "ltd dba",
        "com laude",
        "ip address",
        "ip adresses",
        "U of A",
        "GoA",
        "Treaty 6",
        "Treaty 7",
        "Treaty 8",
        "AHS"
      ],
      "references": [
        "cmdline.txt",
        "config.txt",
        "COPYING.linux",
        "config-5.15.44-Re4son-v7+",
        "config-5.15.44-Re4son-v7l+",
        "config-5.15.44-Re4son-v8l+",
        "config-5.15.44-Re4son+",
        "config-5.15.44-Re4son-v8+",
        "grub_background.sh",
        "LICENCE.broadcom",
        "README",
        "theme.txt",
        "https://www.virustotal.com/gui/file/4b2f7e790d88a330808e6b2a81c8ea81268f69eb6c10ad4beccf2063158d0423/details",
        "https://www.virustotal.com/gui/file/4b2f7e790d88a330808e6b2a81c8ea81268f69eb6c10ad4beccf2063158d0423/relations",
        "https://www.virustotal.com/gui/file/4b2f7e790d88a330808e6b2a81c8ea81268f69eb6c10ad4beccf2063158d0423/behavior",
        "https://www.virustotal.com/gui/collection/cd709a94571c706f4c86a2432508b5fa9e3618a4ba42f5773306208a431ae01e",
        "https://www.virustotal.com/graph/embed/g24019548c37d405da58015e7220072ab73c17ac93ac14e538e1f4535dda6c615?theme=dark",
        "https://www.virustotal.com/gui/collection/cd709a94571c706f4c86a2432508b5fa9e3618a4ba42f5773306208a431ae01e/iocs"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "Canada"
      ],
      "malware_families": [],
      "attack_ids": [
        {
          "id": "T1010",
          "name": "Application Window Discovery",
          "display_name": "T1010 - Application Window Discovery"
        },
        {
          "id": "T1011",
          "name": "Exfiltration Over Other Network Medium",
          "display_name": "T1011 - Exfiltration Over Other Network Medium"
        },
        {
          "id": "T1050",
          "name": "New Service",
          "display_name": "T1050 - New Service"
        },
        {
          "id": "T1070",
          "name": "Indicator Removal on Host",
          "display_name": "T1070 - Indicator Removal on Host"
        },
        {
          "id": "T1080",
          "name": "Taint Shared Content",
          "display_name": "T1080 - Taint Shared Content"
        },
        {
          "id": "T1211",
          "name": "Exploitation for Defense Evasion",
          "display_name": "T1211 - Exploitation for Defense Evasion"
        },
        {
          "id": "T1059",
          "name": "Command and Scripting Interpreter",
          "display_name": "T1059 - Command and Scripting Interpreter"
        }
      ],
      "industries": [
        "Education",
        "Government",
        "Healthcare",
        "Telecommunications",
        "Agriculture",
        "Finance",
        "Transportation"
      ],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 0,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "UCP_GoA23",
        "id": "382539",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_382539/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "domain": 812,
        "URL": 2492,
        "hostname": 1171,
        "FileHash-SHA256": 2057,
        "CVE": 2,
        "FileHash-MD5": 14,
        "FileHash-SHA1": 16,
        "email": 2,
        "CIDR": 118
      },
      "indicator_count": 6684,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 20,
      "modified_text": "78 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    }
  ],
  "error": null,
  "vt": {
    "error": "VirusTotal rate limit reached. Try again shortly.",
    "indicator": "https://forms.static.microsoft/scripts/dists/dll-react.min.aadf17e.js",
    "type": "URL"
  },
  "abuseipdb": null,
  "urlhaus": {
    "indicator": "https://forms.static.microsoft/scripts/dists/dll-react.min.aadf17e.js",
    "type": "URL",
    "found": false,
    "verdict": "clean",
    "error": null
  },
  "from_cache": true,
  "_cached_at": 1780317908.3838367
}